gha: ci-on-push: Adapt chained jobs to workflow_run

As we're using the `workflow_run` event, the checkout action would
pull the **current target branch** instead of the PR one.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -2,6 +2,10 @@ name: CI | Build kata-static tarball for amd64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -25,6 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.checkout-ref }}
           fetch-depth: 0 # This is needed in order to keep the commit ids history
       - name: Build ${{ matrix.asset }}
         run: |
@@ -50,6 +55,8 @@ jobs:
     needs: build-asset
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: get-artifacts
         uses: actions/download-artifact@v3
         with:

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -2,6 +2,10 @@ name: CI | Build kata-static tarball for arm64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -29,6 +33,7 @@ jobs:
 
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.checkout-ref }}
           fetch-depth: 0 # This is needed in order to keep the commit ids history
       - name: Build ${{ matrix.asset }}
         run: |
@@ -58,6 +63,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: get-artifacts
         uses: actions/download-artifact@v3
         with:

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -2,6 +2,10 @@ name: CI | Build kata-static tarball for s390x
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -25,6 +29,7 @@ jobs:
 
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.checkout-ref }}
           fetch-depth: 0 # This is needed in order to keep the commit ids history
       - name: Build ${{ matrix.asset }}
         run: |
@@ -55,6 +60,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: get-artifacts
         uses: actions/download-artifact@v3
         with:

.github/workflows/ci-on-push.yaml

@@ -11,12 +11,14 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
     with:
+      checkout-ref: ${{ github.event.workflow_run.head_sha }}
       tarball-suffix: -${{ github.event.workflow_run.head_sha }}
 
   publish-kata-deploy-payload-amd64:
     needs: build-kata-static-tarball-amd64
     uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
     with:
+      checkout-ref: ${{ github.event.workflow_run.head_sha }}
       tarball-suffix: -${{ github.event.workflow_run.head_sha }}
       registry: ghcr.io
       repo: ${{ github.repository_owner }}/kata-deploy-ci
@@ -28,6 +30,7 @@ jobs:
     needs: publish-kata-deploy-payload-amd64
     uses: ./.github/workflows/run-k8s-tests-on-aks.yaml
     with:
+      checkout-ref: ${{ github.event.workflow_run.head_sha }}
       registry: ghcr.io
       repo: ${{ github.repository_owner }}/kata-deploy-ci
       tag: ${{ github.event.workflow_run.head_sha }}-amd64

.github/workflows/publish-kata-deploy-payload-amd64.yaml

@@ -2,6 +2,10 @@ name: CI | Publish kata-deploy payload for amd64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -24,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
 
       - name: get-kata-tarball
         uses: actions/download-artifact@v3

.github/workflows/publish-kata-deploy-payload-arm64.yaml

@@ -2,6 +2,10 @@ name: CI | Publish kata-deploy payload for arm64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -28,6 +32,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
 
       - name: get-kata-tarball
         uses: actions/download-artifact@v3

.github/workflows/publish-kata-deploy-payload-s390x.yaml

@@ -2,6 +2,10 @@ name: CI | Publish kata-deploy payload for s390x
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -28,6 +32,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
 
       - name: get-kata-tarball
         uses: actions/download-artifact@v3

.github/workflows/run-k8s-tests-on-aks.yaml

@@ -2,6 +2,10 @@ name: CI | Run kubernetes tests on AKS
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ${{ github.sha }}
       registry:
         required: true
         type: string
@@ -35,6 +39,8 @@ jobs:
     needs: create-aks
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: Install `bats`
         run: |
           sudo apt-get update